Subject: CAcert Code Development list.
List archive
- From: Michael Tänzer <michael.taenzer AT cacert.org>
- To: Wytze van der Raay <wytze AT cacert.org>, Benny Baumann <benbe AT cacert.org>
- Cc: "critical-admin AT cacert.org" <critical-admin AT cacert.org>, cacert-devel AT lists.cacert.org, Marcus Mängel <inopiae AT cacert.org>, Martin Gummi <martin.gummi AT cacert.org>
- Subject: Re: Patch Request Bug #569 - Follow Up Patch
- Date: Sun, 20 Oct 2013 17:34:05 +0200
- Openpgp: id=9940BEF1
Hi Wytze,
On 17.10.2013 18:02, Wytze van der Raay wrote:
> On 16.10.2013 17:56, Benny Baumann wrote:
>> it's been some time since we first submitted a fix for Bug 569 and there
>> were still some issues left. Thus here's a minor tweak for the initially
>> submitted patch. In order for this to apply propely make sure the
>> initial patch for bug 569 has been applied and proceed with this one
>> afterwards.
>
> I'm sorry, but this is not really workable for us. The initial patch which
> you provided on 13.05.2013 is no longer valid against the current state of
> the production code -- it produces a lot of mismatches (see attached log).
> So please provide a new version of that, which can be applied cleanly
> against
> the current production code -- in the process you migth as well roll in the
> little "v2patch". We don't mind patches on patches, but they should be valid
> against the current code -- sorting out what is still relevant and what
> isn't, should *not* be done on the production server.
I have done a new diff against the tarballs branch, that should apply
cleanly. It contains all neccessary changes for #569. Please apply that one.
--
Regards
Michael Tänzer
diff --git a/includes/account.php b/includes/account.php index 54373b0..2addca1 100644 --- a/includes/account.php +++ b/includes/account.php @@ -10,7 +10,7 @@ but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. - + You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA @@ -82,7 +82,7 @@ if($checkemail != "OK") { showheader(_("My CAcert.org Account!")); - if (substr($checkemail, 0, 1) == "4") + if (substr($checkemail, 0, 1) == "4") { echo "<p>"._("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.")."</p>\n"; } else { @@ -149,8 +149,13 @@ $delcount = 0; if(array_key_exists('delid',$_REQUEST) && is_array($_REQUEST['delid'])) { + $deltitle=false; foreach($_REQUEST['delid'] as $id) { + if (!$deltitle) { + echo _('The following email addresses have been removed:')."<br>\n"; + $deltitle=true; + } $id = intval($id); $query = "select * from `email` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."' and `email`!='".$_SESSION['profile']['email']."'"; @@ -168,11 +173,9 @@ { echo _("You did not select any email accounts for removal."); } - if($delcount > 0) + if(0 == $delcount) { - echo _("The following accounts have been removed:")."<br>\n"; - } else { - echo _("You failed to select any accounts to be removed, or you attempted to remove the default account. No action was taken."); + echo _("You did not select any accounts to be removed, or you attempted to remove the default account. No action was taken."); } showfooter(); @@ -317,11 +320,11 @@ showfooter(); exit; } - + write_user_agreement(intval($_SESSION['profile']['id']), "CCA", "certificate creation", "", 1); $query = "insert into emailcerts set - `CN`='$defaultemail', + `CN`='$defaultemail', `keytype`='NS', `memid`='".intval($_SESSION['profile']['id'])."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()), @@ -352,7 +355,7 @@ } else if($_REQUEST['keytype'] == "MS" || $_REQUEST['keytype'] == "VI") { if($csr == "") $csr = "-----BEGIN CERTIFICATE REQUEST-----\n".clean_csr($_REQUEST['CSR'])."\n-----END CERTIFICATE REQUEST-----\n"; - + if (($weakKey = checkWeakKeyCSR($csr)) !== "") { $id = 4; @@ -361,7 +364,7 @@ showfooter(); exit; } - + $tmpfname = tempnam("/tmp", "id4CSR"); $fp = fopen($tmpfname, "w"); fputs($fp, $csr); @@ -420,8 +423,8 @@ showfooter(); exit; } - $query = "insert into emailcerts set - `CN`='$defaultemail', + $query = "insert into emailcerts set + `CN`='$defaultemail', `keytype`='".sanitizeHTML($_REQUEST['keytype'])."', `memid`='".$_SESSION['profile']['id']."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()), @@ -581,7 +584,7 @@ { showheader(_("My CAcert.org Account!")); //echo "<p>"._("Email Address given was invalid, or a test connection couldn't be made to your server, or the server rejected the email address as invalid")."</p>\n"; - if (substr($checkemail, 0, 1) == "4") + if (substr($checkemail, 0, 1) == "4") { echo "<p>"._("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.")."</p>\n"; } else { @@ -658,7 +661,7 @@ // In case the CSR is missing the ---BEGIN lines, add them automatically: $CSR = "-----BEGIN CERTIFICATE REQUEST-----\n".$CSR."\n-----END CERTIFICATE REQUEST-----\n"; } - + if (($weakKey = checkWeakKeyCSR($CSR)) !== "") { showheader(_("My CAcert.org Account!")); @@ -666,7 +669,7 @@ showfooter(); exit; } - + if(trim($_REQUEST['description']) != ""){ $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description']))); }else{ @@ -717,7 +720,7 @@ showfooter(); exit; } - + if (($weakKey = checkWeakKeyCSR(file_get_contents( $_SESSION['_config']['tmpfname']))) !== "") { @@ -726,7 +729,7 @@ showfooter(); exit; } - + $id = 11; if($_SESSION['_config']['0.CN'] == "" && $_SESSION['_config']['0.subjectAltName'] == "") { @@ -772,14 +775,14 @@ if(array_key_exists('0',$_SESSION['_config']['rowid']) && $_SESSION['_config']['rowid']['0'] > 0) { - $query = "insert into `domaincerts` set + $query = "insert into `domaincerts` set `CN`='".mysql_real_escape_string($_SESSION['_config']['rows']['0'])."', `domid`='".mysql_real_escape_string($_SESSION['_config']['rowid']['0'])."', `created`=NOW(),`subject`='".mysql_real_escape_string($subject)."', `rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."', `description`='".$_SESSION['_config']['description']."'"; } elseif(array_key_exists('0',$_SESSION['_config']['altid']) && $_SESSION['_config']['altid']['0'] > 0) { - $query = "insert into `domaincerts` set + $query = "insert into `domaincerts` set `CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."', `domid`='".mysql_real_escape_string($_SESSION['_config']['altid']['0'])."', `created`=NOW(),`subject`='".mysql_real_escape_string($subject)."', @@ -846,24 +849,24 @@ printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br/>\n", $id); continue; } - + $row = mysql_fetch_assoc($res); - + if (($weakKey = checkWeakKeyX509(file_get_contents( $row['crt_name']))) !== "") { echo $weakKey, "<br/>\n"; continue; } - + mysql_query("update `domaincerts` set `renewed`='1' where `id`='$id'"); - $query = "insert into `domaincerts` set - `domid`='".$row['domid']."', + $query = "insert into `domaincerts` set + `domid`='".$row['domid']."', `CN`='".mysql_real_escape_string($row['CN'])."', `subject`='".mysql_real_escape_string($row['subject'])."',". //`csr_name`='".$row['csr_name']."', // RACE CONDITION "`created`='".$row['created']."', - `modified`=NOW(), + `modified`=NOW(), `rootcert`='".$row['rootcert']."', `type`='".$row['type']."', `pkhash`='".$row['pkhash']."', @@ -948,7 +951,7 @@ foreach($_REQUEST['revokeid'] as $id) { $id = intval($id); - $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains` + $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains` where `domaincerts`.`id`='$id' and `domaincerts`.`domid`=`domains`.`id` and `domains`.`memid`='".$_SESSION['profile']['id']."'"; @@ -979,7 +982,7 @@ foreach($_REQUEST['delid'] as $id) { $id = intval($id); - $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired` from `domaincerts`,`domains` + $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired` from `domaincerts`,`domains` where `domaincerts`.`id`='$id' and `domaincerts`.`domid`=`domains`.`id` and `domains`.`memid`='".$_SESSION['profile']['id']."'"; @@ -1032,7 +1035,7 @@ foreach($_REQUEST['revokeid'] as $id) { $id = intval($id); - $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts` + $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts` where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) @@ -1040,24 +1043,24 @@ printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id); continue; } - + $row = mysql_fetch_assoc($res); - + if (($weakKey = checkWeakKeyX509(file_get_contents( $row['crt_name']))) !== "") { echo $weakKey, "<br/>\n"; continue; } - + mysql_query("update `emailcerts` set `renewed`='1' where `id`='$id'"); - $query = "insert into emailcerts set - `memid`='".$row['memid']."', + $query = "insert into emailcerts set + `memid`='".$row['memid']."', `CN`='".mysql_real_escape_string($row['CN'])."', `subject`='".mysql_real_escape_string($row['subject'])."', - `keytype`='".$row['keytype']."', - `csr_name`='".$row['csr_name']."', - `created`='".$row['created']."', + `keytype`='".$row['keytype']."', + `csr_name`='".$row['csr_name']."', + `created`='".$row['created']."', `modified`=NOW(), `disablelogin`='".$row['disablelogin']."', `codesign`='".$row['codesign']."', @@ -1106,7 +1109,7 @@ foreach($_REQUEST['revokeid'] as $id) { $id = intval($id); - $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts` + $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts` where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) @@ -1135,7 +1138,7 @@ foreach($_REQUEST['delid'] as $id) { $id = intval($id); - $query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `emailcerts` + $query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `emailcerts` where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) @@ -1271,7 +1274,7 @@ $ddres = mysql_query($ddquery); $ddrow = mysql_fetch_assoc($ddres); $_SESSION['profile']['points'] = $ddrow['total']; - + if($_SESSION['profile']['points'] == 0) { $_SESSION['_config']['user']['fname'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['fname'])))); @@ -1323,7 +1326,7 @@ where `id`='".$_SESSION['profile']['id']."'"; mysql_query($query); - //!!!Should be rewritten + //!!!Should be rewritten $_SESSION['_config']['user']['otphash'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otphash'])))); $_SESSION['_config']['user']['otppin'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otppin'])))); if($_SESSION['_config']['user']['otphash'] != "" && $_SESSION['_config']['user']['otppin'] != "") @@ -1534,9 +1537,9 @@ showfooter(); exit; } - - $query = "insert into `orgemailcerts` set - `CN`='$defaultemail', + + $query = "insert into `orgemailcerts` set + `CN`='$defaultemail', `keytype`='NS', `orgid`='".$org['orgid']."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()), @@ -1566,7 +1569,7 @@ mysql_query("update `orgemailcerts` set `csr_name`='$CSRname' where `id`='$emailid'"); } else if($_REQUEST['keytype'] == "MS" || $_REQUEST['keytype']=="VI") { $csr = "-----BEGIN CERTIFICATE REQUEST-----\n".clean_csr($_REQUEST['CSR'])."-----END CERTIFICATE REQUEST-----\n"; - + if (($weakKey = checkWeakKeyCSR($csr)) !== "") { $id = 17; @@ -1575,7 +1578,7 @@ showfooter(); exit; } - + $tmpfname = tempnam("/tmp", "id17CSR"); $fp = fopen($tmpfname, "w"); fputs($fp, $csr); @@ -1625,8 +1628,8 @@ if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2) $_SESSION['_config']['rootcert'] = 1; - $query = "insert into `orgemailcerts` set - `CN`='$defaultemail', + $query = "insert into `orgemailcerts` set + `CN`='$defaultemail', `keytype`='" . sanitizeHTML($_REQUEST['keytype']) . "', `orgid`='".$org['orgid']."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()), @@ -1683,29 +1686,29 @@ printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id); continue; } - + $row = mysql_fetch_assoc($res); - + if (($weakKey = checkWeakKeyX509(file_get_contents( $row['crt_name']))) !== "") { echo $weakKey, "<br/>\n"; continue; } - + mysql_query("update `orgemailcerts` set `renewed`='1' where `id`='$id'"); if($row['revoke'] > 0) { printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."<br>\n", $row['CN']); continue; } - $query = "insert into `orgemailcerts` set - `orgid`='".$row['orgid']."', + $query = "insert into `orgemailcerts` set + `orgid`='".$row['orgid']."', `CN`='".$row['CN']."', `subject`='".$row['subject']."', - `keytype`='".$row['keytype']."', - `csr_name`='".$row['csr_name']."', - `created`='".$row['created']."', + `keytype`='".$row['keytype']."', + `csr_name`='".$row['csr_name']."', + `created`='".$row['created']."', `modified`=NOW(), `codesign`='".$row['codesign']."', `rootcert`='".$row['rootcert']."', @@ -1822,7 +1825,7 @@ if($process != "" && $oldid == 20) { $CSR = clean_csr($_REQUEST['CSR']); - + if (($weakKey = checkWeakKeyCSR($CSR)) !== "") { $id = 20; @@ -1831,7 +1834,7 @@ showfooter(); exit; } - + if(trim($_REQUEST['description']) != ""){ $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description']))); }else{ @@ -1887,7 +1890,7 @@ if($process != "" && $oldid == 21) { $id = 21; - + if(!file_exists($_SESSION['_config']['tmpfname'])) { showheader(_("My CAcert.org Account!")); @@ -1895,7 +1898,7 @@ showfooter(); exit; } - + if (($weakKey = checkWeakKeyCSR(file_get_contents( $_SESSION['_config']['tmpfname']))) !== "") { @@ -1944,7 +1947,7 @@ if(is_array($_SESSION['_config']['rows'])) foreach($_SESSION['_config']['rows'] as $row) $csrsubject .= "/commonName=$row"; - $SAN=""; + $SAN=""; if(is_array($_SESSION['_config']['altrows'])) foreach($_SESSION['_config']['altrows'] as $subalt) { @@ -2031,29 +2034,29 @@ printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id); continue; } - + $row = mysql_fetch_assoc($res); - + if (($weakKey = checkWeakKeyX509(file_get_contents( $row['crt_name']))) !== "") { echo $weakKey, "<br/>\n"; continue; } - + mysql_query("update `orgdomaincerts` set `renewed`='1' where `id`='$id'"); if($row['revoke'] > 0) { printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."<br>\n", $row['CN']); continue; } - $query = "insert into `orgdomaincerts` set - `orgid`='".$row['orgid']."', + $query = "insert into `orgdomaincerts` set + `orgid`='".$row['orgid']."', `CN`='".$row['CN']."', - `csr_name`='".$row['csr_name']."', + `csr_name`='".$row['csr_name']."', `created`='".$row['created']."', - `modified`=NOW(), - `subject`='".$row['subject']."', + `modified`=NOW(), + `subject`='".$row['subject']."', `type`='".$row['type']."', `rootcert`='".$row['rootcert']."', `description`='".$row['description']."'"; @@ -2286,7 +2289,7 @@ if(($oldid == 29 || $oldid == 30) && $process != "") // _("Cancel") is handled in front of account.php { - $query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where + $query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where `orgdomlink`.`orgdomid`=`orgdomains`.`id` and `orgdomaincerts`.`id`=`orgdomlink`.`orgcertid` and `orgdomains`.`id`='".intval($domid)."'"; @@ -2294,7 +2297,7 @@ while($row = mysql_fetch_assoc($res)) mysql_query("update `orgdomaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$row['id']."'"); - $query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where + $query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where `orgemaillink`.`domid`=`orgdomains`.`id` and `orgemailcerts`.`id`=`orgemaillink`.`emailcertsid` and `orgdomains`.`id`='".intval($domid)."'"; @@ -2338,7 +2341,7 @@ $dres = mysql_query($query); while($drow = mysql_fetch_assoc($dres)) { - $query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where + $query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where `orgdomlink`.`orgdomid`=`orgdomains`.`id` and `orgdomaincerts`.`id`=`orgdomlink`.`orgcertid` and `orgdomains`.`id`='".intval($drow['id'])."'"; @@ -2350,7 +2353,7 @@ mysql_query("delete from `orgdomlink` where `domid`='".intval($row['id'])."'"); } - $query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where + $query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where `orgemaillink`.`domid`=`orgdomains`.`id` and `orgemailcerts`.`id`=`orgemaillink`.`emailcertsid` and `orgdomains`.`id`='".intval($drow['id'])."'"; @@ -2430,8 +2433,8 @@ $row = mysql_fetch_assoc($res); if ( !is_assurer(intval($row['id'])) ) { - $id = $oldid; - $oldid=0; + $id = $oldid; + $oldid=0; $_SESSION['_config']['errmsg'] = _("The user is not an Assurer yet"); } else { @@ -2565,7 +2568,7 @@ exit; } - if($oldid == 54 || ($id == 53 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "") || + if($oldid == 54 || ($id == 53 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "") || ($id == 54 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "" && $_REQUEST['action'] != "aliases" && $_REQUEST['action'] != "edit" && $_REQUEST['action'] != "add")) { @@ -2789,7 +2792,7 @@ showfooter(); exit; } - + if (($weakKey = checkWeakKeyCSR($CSR)) !== "") { showheader(_("My CAcert.org Account!")); @@ -2798,7 +2801,7 @@ exit; } - $query = "insert into `domaincerts` set + $query = "insert into `domaincerts` set `CN`='".$_SESSION['_config']['0.CN']."', `domid`='".$_SESSION['_config']['row']['id']."', `created`=NOW()"; @@ -2862,7 +2865,7 @@ if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0) { - csrf_check('admactlock'); + csrf_check('admactlock'); $memid = $_REQUEST['userid'] = intval($_REQUEST['locked']); $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); @@ -3103,7 +3106,7 @@ while($row = mysql_fetch_assoc($res)) $body .= $row['comment']."\n"; $body .= "\n"; - + $body .= _("Best regards")."\n"; $body .= _("CAcert Support Team"); sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form AT cacert.org", "support AT cacert.org", "", "CAcert Tverify"); @@ -3124,7 +3127,7 @@ $body .= "\n"; $body .= _("You are welcome to try submitting another request at any time in the future, please make sure you take the reviewer comments into consideration or you risk having your application rejected again.")."\n\n"; - + $body .= _("Best regards")."\n"; $body .= _("CAcert Support Team"); sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form AT cacert.org", "support AT cacert.org", "", "CAcert Tverify");
Attachment:
signature.asc
Description: OpenPGP digital signature
- Patch Request Bug #569 - Follow Up Patch, Benny Baumann, 10/16/2013
- Re: Patch Request Bug #569 - Follow Up Patch, Wytze van der Raay, 10/17/2013
- Re: Patch Request Bug #569 - Follow Up Patch, Michael Tänzer, 10/20/2013
- Re: Patch Request Bug #569 - Follow Up Patch, Wytze van der Raay, 10/21/2013
- Re: Patch Request Bug #569 - Follow Up Patch, Michael Tänzer, 10/20/2013
- Re: Patch Request Bug #569 - Follow Up Patch, Wytze van der Raay, 10/17/2013
Archive powered by MHonArc 2.6.18.